Google’s Threat Intelligence Group (GTIG) has uncovered a long-running Chinese cyber-espionage campaign that targeted North American medical, academic, and military research institutions, remaining undetected for well over a year. The operation, attributed with high confidence to a People’s Republic of China (PRC)-nexus threat actor designated UNC6508, leveraged a novel combination of web shell deployment, a sophisticated modular malware called INFINITERED, and an unprecedented technique of using legitimate cloud email compliance rules for data exfiltration.

The Threat Actor: UNC6508

GTIG attributes the campaign to UNC6508, a PRC-nexus group with clear espionage motivations. The group’s collection priorities are closely aligned with Chinese state strategic interests, spanning national defense intelligence, Indo-Pacific military operations, artificial intelligence research, uncrewed vehicle systems, offensive cyber programs, and medical research. The earliest known compromise dates back to September 2023, with activity observed continuously through November 2025 — a span of over two years of stealthy access.

Initial Access: Exploiting REDCap Servers

The campaign’s initial foothold began with externally facing REDCap (Research Electronic Data Capture) servers, a widely used web-based platform in North American medical and scientific research communities. REDCap is used by thousands of institutions to collect, manage, and protect research data — making it an attractive target for intelligence collection.

While GTIG could not confirm the exact initial access vector, UNC6508 was observed actively probing for legacy, unpatched REDCap versions running alongside current installations — a classic downgrade attack technique (MITRE ATT&CK T1689). Upon gaining entry, the threat actor deployed a web shell named help.php, performed internal reconnaissance, and harvested database and service account credentials.

INFINITERED: The Modular Persistence Malware

Three months after gaining initial access, UNC6508 deployed INFINITERED — a sophisticated, modular malware that trojanizes legitimate REDCap system files, making it exceptionally difficult to detect and persistent even through software updates. INFINITERED operates through three key components:

• Dropper/Upgrade Interceptor: Injects malicious code into new REDCap upgrade packages, ensuring persistence even after software updates using a hardcoded GUID delimiter (b49e334d-9c01-463e-9bc5-00a6920fb66e). Organizations that thought upgrading REDCap would clean up a compromise would have been mistaken.
• Credential Harvester: Captures plaintext usernames and passwords from POST login requests, encrypts them, and stores them covertly in the REDCap sessions database under the prefix xc32038474a.
• Backdoor with C2: Activates on every REDCap page load, listens for a specific HTTP Cookie parameter REDCAP-TOKEN, and supports commands including remote shell execution, SQL queries, file upload and download, and system beaconing.

INFINITERED was discovered across multiple organizations in both the US and Canada, demonstrating the breadth of the campaign.

A Novel Exfiltration Technique: Gmail BCC-Forwarding

After more than a year of silent access, UNC6508 escalated by using harvested credentials to access a domain administrator account. The group then abused content compliance rules — a legitimate Google Workspace feature — to silently BCC-forward sensitive emails to an attacker-controlled Gmail account: BebitaBarefoot774[@]gmail[.]com.

The rule, named “Patroit” (a misspelling of “Patriot”), used regular expressions to match nearly 150 keywords spanning military strategy, AI research, cyber programs, and medical topics. GTIG notes that this technique — using domain content compliance rules for data exfiltration — had never previously been observed from a PRC-nexus actor, representing a significant evolution in the group’s tradecraft.

One keyword stood out among the rest: “Chikungunya” — the mosquito-borne virus responsible for a July 2025 outbreak in China’s Guangdong province — suggesting real-time, mission-specific intelligence tasking by handlers within China.

Defense Evasion and Infrastructure

UNC6508 used US-based obfuscation networks to route traffic through compromised ASUS routers, residential proxies, and VPS infrastructure to avoid detection and complicate attribution. The combination of trojanized legitimate software, credential-based persistence, and traffic obfuscation allowed the group to operate undetected for an extraordinarily long period.

Defensive Recommendations

GTIG disrupted the malicious infrastructure and deactivated the Gmail exfiltration account upon discovery. Immediate recommended actions include:

• Patch REDCap to the latest version and completely remove all legacy installations — do not run old and new versions side by side
• Enforce phishing-resistant 2-Step Verification (2SV) for all administrator accounts
• Scan REDCap servers for INFINITERED using the published YARA rule from GTIG
• Audit content compliance rules in cloud mail suites for unauthorized BCC-forwarding configurations
• Deploy Device Bound Session Credentials (DBSC) to prevent session cookie theft
• Enable DLP rules and SIEM logging to detect anomalous data movement and email forwarding

GTIG has updated Google Security Operations (SecOps) with all relevant IOCs and has notified affected organizations directly. The key takeaway from this campaign is that research institutions must treat their data management platforms with the same security rigor applied to production enterprise systems — REDCap servers are high-value targets for nation-state adversaries.